ClawHub
Back to skill

Security audit

ClawCost

Security checks for vulnerabilities and agentic risk

Overview

ClawCost is a local cost-reporting skill that reads OpenClaw session logs and optionally stores local budget or balance settings, with no evidence of network transmission or hidden persistence.

Install only if you are comfortable with the skill reading your local OpenClaw session logs to compute spending. Use the balance-setting command only when you want it to write local settings under ~/.clawcost/config.json; be aware the separate --format json path appears to contain a bug.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is cost tracking, but the behavior includes writing persistent configuration to ~/.clawcost/config.json and maintaining balance/budget state that is not disclosed in the description. This mismatch is dangerous because users may execute what appears to be a read-only reporting skill without realizing it modifies local files and stores state; the referenced broken JSON path also suggests weak implementation quality that can produce unsafe or unpredictable behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README says the skill 'responds to natural language' and lists short phrases like 'check cost' and 'cost breakdown' without clarifying trigger boundaries, context, or exclusion conditions. These phrases are generic enough to overlap with ordinary conversation about costs, making activation scope ambiguous.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

md
ClawCost reads your OpenClaw session logs to calculate costs. It only accesses:
- `~/.openclaw/agents/main/sessions/*.jsonl` (read-only)
- `~/.clawcost/config.json` (read/write for settings)

No data is transmitted externally. All processing is local.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes a local Python script but declares no explicit tool scope or permissions, while the detected capabilities include environment access plus file read/write. That creates an unnecessary trust gap: consumers of the skill cannot tell from the manifest that it may access local state or persist data, which can lead to unintended file-system effects when the skill is run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script reads files from the user's ~/.openclaw/agents/main/sessions directory and parses per-message usage data, which is user/system data. While this is central to the tool's purpose, the code does not include a clear disclosure at the point of access beyond a generic module docstring, so users may not realize local session history is being scanned.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The tool documents itself as a cost monitor for the current user's OpenClaw usage, and elsewhere derives the user from the environment at L143-L145. However, the JSON-output branch uses args.user at L174 even though no --user argument is defined, so the documented/user-reporting intent diverges from the implemented behavior and will raise an error instead of producing output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.